ci: correct trivy tag and make the build artifact non-empty

trivy-action tags are v-prefixed from 0.33.0 onward; @0.36.0 does not
resolve and failed the Security Scan job at set-up.

The build artifact uploaded nothing: ".next" is a dotfile directory and
upload-artifact skips hidden paths unless include-hidden-files is set.
This was pre-existing -- the build job had never run to completion, so
it had never been observed.

Verified the path patterns directly against @actions/glob (the library
upload-artifact uses): with hidden files included, ".next/" matches 202
entries and the "!.next/cache/" exclusion brings that to 140.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: soodoku

.github/workflows/ci.yml

@@ -117,6 +117,9 @@ jobs:
           path: |
             .next/
             !.next/cache/
+          # .next is a dotfile directory, and upload-artifact skips hidden
+          # paths by default -- without this the artifact is empty.
+          include-hidden-files: true
           retention-days: 1
 
   security-scan:
@@ -128,7 +131,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.36.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'